CN101779436B - Tracking the origins of data and controlling data transmission - Google Patents

Abstract

Provided are methods, apparatus and computer programs for tracking the origins of data and controlling transmission of the data. In one embodiment, transmission of sensitive data by script operations is limited, to prevent transmission to any network location other than to the source of that sensitive data, by a new function within a scripting engine of an HTTP client that is responsive to origin tags placed within the data. Origin tags that are associated with data inputs are propagated to any output data items, so that transmission of derived information can also be controlled.

Description

A method and system for controlling the transmission of sensitive data

technical field

The present invention relates to methods, data processing systems for tracking the origin of data and controlling the transfer of sensitive data to scriptable clients such as web browsers. the

Background technique

A web browser is one that runs on a user's data processing device and provides access to information on the World Wide Web (using the Hypertext Transfer Protocol (HTTP) to submit requests to a web server computer to retrieve web pages and browse or interact with web content) Computer program. Some web browsers and similar HTTP clients interpret scripting languages. Typically, JavaScript ^™ is used, although some web browsers understand VBScript (Visual Basic Scripting) and the mechanism can be extended to other languages. By including scripting language instructions in the text of a page, an author can cause it to exhibit arbitrarily complex behavior and, or alternatively, appear as a static document when viewed with a suitably capable browser. Such instructions may be included directly, or by reference to a separate document in which they are contained.

Embedded scripting instructions in web pages are interpreted by a subsystem or "scripting engine" within the browser. The engine itself is written in a programming language (typically a more structured language like C++ or Java ^™ ). The engine is capable of performing multiple operations; each scripting language instruction is literally an instruction for the engine to perform a specific one of its available operations.

The scripting engine also accesses data structures representing the web pages themselves within the browser. Some of the operations that can be performed by the engine involve reading from or writing to these data structures, effectively editing the page when viewed within a browser. Other sources of data that can be used in script actions include script variables that can be set with initial values or populated from any other source, and other data that is downloaded separately using a technique known as "XMLHttpRequest". the

As with strictly manipulating information within a scripting engine and exchanging information with the internal representation of a web page, there is a class of scripting instructions that cause the browser to interact with other systems via its network connections, or perform other actions typically ordered by a human user. The choice of instructions available in this set is typically limited in order to reduce the impact that malicious scripts may have. the

It is important to note that because scripts appear as part of a web page, and because scripts themselves may contain information that may later be inserted into the page, scripts themselves are forms of data, and all considerations of "data elements" in this invention The same applies to the list of directives that make up the script. the

As an example of how the above facility may be used, consider a web-based document editing application delivered in the form of a web page using AJAX (Asynchronous JavaScript and XML) technology. The graphical web browser initially downloads the page carrying the various display elements such as rulers, buttons and edit document fields and also references the file of scripting instructions. These instructions instruct the scripting engine on how to respond to the user's actions. For example, if the user were to activate a "bold" button, the scripting engine could be instructed to first read the page in order to determine which words in the text area the user has selected. This information will be used by another instruction that modifies the page data structure in a way that marks the text as bold. Eventually, another part of the browser called the "rendering engine" will read those tags and, as a result, will cause the tagged words to appear on the page in a boldface appearance. the

Scriptable HTTP clients such as JavaScript-enabled web browsers traditionally load data from only one source location at a time. However, it is desirable in a Web services environment to be able to combine scripts and data from several source locations into one scripting environment. Returning to the example of a web-based document editing application, users typically need to expose and delegate their documents to the provider of the application, eg, by uploading the document to the provider's server. the

Although a large number of applications are currently becoming available via the World Wide Web in the form of Web services that develop scripts that run within Web browsers and communicate with Web servers, many organizations and individuals are unwilling to accept the inherent security of their confidential documents. exposed. This limits the use of available applications. the

For such applications written in a scripting language within the client, it would be possible to run on data obtained from one or more different locations. However, once the script and data are loaded into the scripting environment, there is currently no mechanism in place for ensuring that the script is not transmitted maliciously or in the process of providing data such as spell checking back to its own server. Known solutions involve preventing unauthorized scripts from accessing certain files and objects, but this may be overly restrictive. the

For example, US Patent No. 6,986,062 describes controlling a script's ability to access an object based on the origin of the script and defined permissions. Entries in the client's access control data structure include a source identifier field and a permission identifier field associated with the object - the source of the script is recorded and subsequently checked, and unauthorized scripts are prevented from accessing certain objects. the

US Patent No. 6,505,300 describes restricting the execution of text to untrusted content such as scripts. When a process attempts to access a resource, the token associated with the process is compared with the resource's security information to determine whether the access is permitted. The source of a script determines how it is trusted and what processes can be performed on a particular resource. the

US Patent Application No. 2006/0230452 discloses obtaining files from external locations and adding tagging information about the source of the obtained files. The source of the obtained file can be used in subsequent security policy decisions, such as allowing or blocking the execution or presentation of the content. the

Contents of the invention

A first aspect of the invention provides a method, performed within a scripting environment, of controlling the transfer of sensitive data comprising the steps of: associating an indication of origin with a first data element; propagating the indication of origin to a data element generated from the first data element; and restricting transmission of the first data element and said generated data element to only permitted destinations, wherein said permitted destination is identified with reference to an indication of a source. the

The first data element may comprise a portion of a set of data elements, and potentially a very large set of data, with which the indication of source is associated. The generated data element may also be one of a set of generated data elements. the

In one embodiment of the invention, the first data element and any data elements generated from the first data element are prevented from being transmitted to any source other than the source of the first data element. This prevents script editing operations from transferring sensitive data across the network to any network node other than the source of the data, while allowing scripts to cooperate within the constraints of the rules limiting data transfer. the

In one embodiment, if a new data element is generated within the scripting environment from a plurality of data elements each having an associated indication of origin, the new data element will have an associated indication of origin derived from the plurality of data elements. If multiple sensitive input data elements have different origins, the step of restricting transmission prevents output data from being transmitted to any destination; while output resulting from multiple input data elements with a common origin can be transmitted back to a common source while preventing its transmission to any other destination. the

The step of restricting transfers is advantageous within a scripting environment where "untrusted" scripts are run. An "untrusted" script in this context is any script for which there is no security control or trust to verify the script or its provider (thus, the term "untrusted" does not imply that the script or its provider has identified as having any malicious intent). the

When the data is manipulated by a script, the invention provides protection of sensitive data, ensuring that the script does not send that data to any server that does not already have the information, without the need to verify the trustworthiness of the script or its provider. The steps of associating and propagating the indication of origin can be accomplished by a scripting engine within the web browser that responds to security tags within the data to prevent any script from sending the marked data to a location other than the source location of the data. A "script editing engine" according to one embodiment includes a script interpreter, a tag generator, and a tag propagator. the

A second aspect of the present invention provides a data processing system comprising: at least one data processing unit; at least one data storage unit; a script interpreter; means for associating an indication of a source with a first data element; means for propagating an indication of origin to a new data element generated from a first data element; and means for restricting transmission of the first data element and said generated data element from the data processing system to permitted destinations only, wherein reference The indication of source identifies the destination of the license. the

In one embodiment of this second aspect, the script interpreter, the means for associating, the means for propagating and the means for restricting transmission are all within a scriptable HTTP client computer program such as a web browser accomplish. In one embodiment, the components for associating and the components for propagating are provided as features of an improved scripting engine within an HTTP client program, which can make the scripting engine available as a computer-readable Program Product of Program Code. the

Description of drawings

The embodiment of the present invention is described in more detail below by way of example with reference to the accompanying drawings, in the accompanying drawings:

Figure 1 is a schematic representation of a network in which the present invention can be implemented;

Figure 2 shows an example client data processing system in which the present invention can be implemented;

Figure 3 shows the components of a scripting engine according to an embodiment of the invention;

Figure 4 shows a sequence of interactive operations between a client and a server according to an embodiment of the invention, in which an origin tag is generated and stored, thereafter propagated to new data elements and then used to block sensitive transfer of data to a destination other than the source of the data; and

FIG. 5 shows a sequence of operations for propagating annotations according to an embodiment of the present invention. the

Detailed ways

1. Network environment and sample client system

The distributed data processing network shown schematically in Fig. 1 includes any number of client data processing systems 10, 20, 30 and server data processing systems 40, 50 and 60 communicating with each other via HTTP. Although the present invention is not limited to a specific type of data processing system in terms of system hardware or operating system environment, a typical client system 10 as schematically shown in FIG. 2 may include at least one data processing unit 100, at least one A laptop or desktop data processing system with a data storage unit, internal communication unit 130, input/output components, and network interface 190, the at least one data storage unit typically including volatile system memory 110 and storage devices such as disk storage A non-volatile storage component 120 , the input/output component includes a device driver 140 and a connection interface 150 for a mouse 160 , a keyboard 170 and a monitor 180 . A typical client system used in the implementation of the present invention has a number of program code components installed thereon, including operating system software 200, a web browser 210, and a number of application programs 220,230. Web browser 210 is adapted to interact with remote Web servers via network communications using a request-response HTTP model. Each of Web servers 40, 50, and 60 may include one or more HTTP servers 70 and one or more application servers 80, 90, either on a single server data processing system or cooperatively to provide high availability and throughput server farms but the present invention does not require any particular web server architecture. the

In the client system used in the present invention, the web browser 210 includes a script interpreter, which includes most of the components of the script editing engine 240 , enabling execution of scripts within downloaded web pages. Various components and features of the present invention are described below with reference to FIGS. 3 through 6 in the context of embodiments of the invention, several of which are implemented as program code components of the novel scripting engine. As shown in FIG. 3 , the script editing engine 240 includes a script interpreter 250 , a source tag generator 260 and a tag propagator 270 . Those skilled in the art will appreciate that the various components of the present invention, such as the means for blocking transmission described below, could equally be implemented as hardware components, such as application specific integrated circuits (ASICs). the

The generated and propagated tags are used by web browsers or other HTTP clients to control the transmission of sensitive data elements, as described below. the

2. Generation and storage of tags indicating origin

As mentioned above, there are a variety of data elements that can be used in the operation of the scripting engine. All of these elements are stored in data structures associated with scripting engine 240 itself or with web browser 210 (or, in other implementations, another program of which the scripting engine is a part). Although scripting operations read and modify data within these data structures as part of their inner workings, there are no scripting operations by which a script can inspect or alter the data structures themselves for their own purposes. the

In existing scripting engines, these data structures typically contain the current value of the data element and some additional information for use by the scripting engine. An example of such information is information about automatic garbage collection. The present invention involves associating an indication of origin with a data element, and "comments" to the data elements involved in implementing the present invention may be stored in the scripting engine's data in the same manner as other information provided for use with the scripting engine in structure. This means that only minor changes are required to current web browsers and other scriptable HTTP client programs to implement the invention, and ensures that no mechanism is available for a script to interfere with its own annotations. the

Figure 4 illustrates the series of steps involved in the initial generation of a source-indicating label or "note" for a set of data elements. All data considered sensitive must be assigned a source tag before it is first used in a scripted action. There are many ways in which data can be introduced into modern web browsers, but most of them involve the HTTP protocol (specified in W3C Web Working Group Request for Comment 2616 "Hypertext Transfer Protocol - HTTP/1.1", June 1999). For such an approach, a web browser or other HTTP client adapted to implement the present invention may use a special HTTP header in the request and another special HTTP header in the response. Note that the HTTP specification allows the use of additional headers; systems that do not implement the relevant functionality will ignore the associated headers. the

Thus, as shown in FIG. 4, the client-server interaction sequence according to an embodiment of the present invention begins with a scriptable client such as a web browser sending 300 an HTTP request to the web server. Although not all HTTP clients will implement the invention, clients that implement the invention will typically include (among many headers with each request of the data) a new header indicating this fact. the

Currently available web browsers already send a lot of information about the functionality they support, and even the kind of content their users want, such as which (human) languages are acceptable. For example, a request might look like this:

GET/HTTP/1.1

Host: ibm.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: 1.5)

Accept: text/xml, application/xml, application/xhtml+xml, text/html; q=0.9,

text/plain: q=0.8, video/x-mng, image/png, image/jpeg, image/gif; q=0.2, */*; q=0.1

Accept-Language: en-us, en; q=0.5

Accept-Encoding: gzip, deflate

Accept-Charset: ISO-8859-l, utf-8; q=0.7, *; q=0.7

Keep-Alive: 300

Connection: keep-alive

A new request header can be added to identify whether the requester can provide protection for "safe" content. The content-type "safe" is different from existing content-classes (because it is not a MIME type, human language, encoding type, or charset). In the first embodiment, the new Requestor header has the field name "Accept-Security", but this is only an illustrative example. Whatever the field name may be, the new header field MAY be a simple indication to the requesting client whether or not to provide content protection using an origin tag. the

The request header "Accept-Security:Origin Tag" implies that the browser can protect secure data if the server wishes to send it, but it does not require secure data. Extra headers can be included in every HTTP request, although this is not required. Such a new header allows future extensions of security with different kinds of optional implementations. For example, an "Accept-Security:" request header and restricting the transmission of content based on origin tags can be implemented with another security option. the

The server accesses 310 the requested page ready for download to the client, but the web server can be configured to check for the presence of new request headers before transmitting any sensitive data. When responding to an HTTP request, the check may be performed on all HTTP requests, or only in response to the Web server identifying sensitive data within the accessed page if the Web server provides a mechanism to detect an indication of data sensitivity. In one embodiment, an indication of data sensitivity may be inserted when the data is created or stored on the content server. the

The specific sequence in which client capabilities are checked before or after the check of data sensitivity is not critical to the present invention. If the web server identifies sensitive information within the requested page, and the web server determines that the requesting client has not committed to protecting the data (i.e., did not include a new header in the request), the server according to one embodiment of the invention either rejects the request or passes Serve request pages without sensitive data in reply to 320 clients. the

Web servers can be programmed and configured to behave in different ways (and some web servers may not implement any new functionality to support the invention), but the new request headers provided in the invention make it possible for servers to make decisions about whether to provide notification of sensitive data . The server may then refuse to provide its sensitive data to any client that has not informed the respective server of the client's capabilities and commitment to protecting the sensitive data. the

Note that the embodiments of the invention described above do not include any mechanism whereby an HTTP client claiming to protect sensitive data is blocked when the HTTP client does not in fact protect the sensitive data. In this first embodiment, the HTTP client is considered to be a proxy for a human user, and the scope of the invention extends only to data that the user believes. Known user authentication solutions should be used to ensure that only authorized users have access to sensitive data. the

If the web server identifies sensitive data in the requested page and inspection of the fields in the request header determines that the requesting client provides protection for the sensitive data, the web server transmits 330 the requested page and a "sensitive data" flag to the requesting client. Although not relevant to the present invention, it is generally desirable to protect any transmission of sensitive data using a security mechanism such as the Secure Sockets Layer to prevent its theft in transit. the

Therefore, in this embodiment, the determination of which data is sensitive is performed by the server providing it. According to the invention, when providing 330 sensitive data in response to an HTTP request, the response will carry a header indicating that its content is to be treated as sensitive data. The “Sensitive Data” header may include explicit instructions from the web server regarding specific origin information to include in the origin tag, and this instruction will only work through the origin tag generator 260 . If the client receiving 340 the data is scriptable, and the data is to be placed in an area of storage accessible to script operations, the client must attach the source tag to the 350 data. Thereafter, origin tags are propagated 360 from received data elements to any new data elements generated within the client (described below), and origin tags are used to control the transmission 370 of tagged data elements (described below). the

The server can determine the precision with which to describe the source in the tag. For example, a small company might serve all documents on its intranet with a header that causes the browser to apply an origin tag of "company.com" to the data. The script can then send that data to any system within the company, but not anywhere outside. Larger companies may restrict some of their data more strictly, perhaps with headers that cause browsers to flag "secretdocstore.r-and-d.company.com" or "webapps.finance.company.com" for them. A web application that cannot be trusted to serve data on a shared server that may also reside on other applications here makes it mark the domain "apps.sharedhostingcompany.com" with the port number "8080" and the file path "/customers/account42/secretdocs"; This provides an indication based on the source of location information that is private under the control of a particular web application, while other locations on the same server may be less precisely specified. Therefore, a location under the dedicated control of a web application may be specified as follows:

http://apps.sharedhostingcompany.com:8080/customers/account42/secretdocs/

The above labeling scheme thus has enough precision to handle the case of shared servers; whereas when not handling shared servers, the hostname may suffice. the

Information entered into script dialogs and text boxes on pages, as well as data loaded from local files, has no source server to which it may entrust sensitive issues. This problem can be addressed by labeling information obtained from a user or otherwise obtained from or generated on the computer on which the scripting engine is running, where a special source tag means "local". This tag is broadly similar to other source tags, but may be given special treatment as described below. the

Most browsers can also access data via protocols other than HTTP, of which File Transfer Protocol (FTP) is a widely used example. In some cases, these protocols can also be extended with additional headers as described above for HTTP; It is more appropriate to process the data in the same manner as when using the protocol. Even if there are some esoteric protocols left without a source tagging system, the invention is still useful and effective because they are unlikely to be used for the kind of web applications that would benefit from the invention. the

In one embodiment of the present invention, the above-described technique for generating and storing annotations is enhanced to reduce the storage capacity required for annotation propagation and allow it to be implemented more quickly. In a typical application, there will be only a small number of annotation values (perhaps only one) in use at any time, but these values may apply to a large number of individual data elements. This enhancement takes this property into account and utilizes a central table of source values. Each annotation only needs to point to the appropriate row of the table, and does not need to carry its own copy of the value. the

3. Dissemination of labels

Once a data item has a source tag, the same tag is propagated 360 to any other data derived from it. More specifically, for all script operations that have both inputs and outputs, any source tags present in the data structures of the former will be passed by the tag propagator component 270 of the scripting engine 240 to the corresponding data structures of the latter. For example, the JavaScriptString.subString() method is an operation that takes a text string as input and produces a shorter text string as output. If this method is used in the scripting engine 240 according to the present invention to extract some text from a page secured by "example.com", the extracted text will also be marked with the origin of "example.com". For this embodiment, any scripting operation performed on an object should be considered to take that object as input. the

As stated in the Background section above, scripting engines are typically written in a structured language and provide certain operations. These operations are defined by program code written in this structured language. In this embodiment, the additional behaviors described in this section are implemented by adding label propagation functionality to the program code within the script editing engine. In a scripting engine not implementing the present invention, the script would continue to require a series of operations as it would, but generate 350 source tags and then propagate 360 transparently to the user and scripter. the

Output data gets a special label when a script action is run on more than one input and at least two of the inputs have source labels that do not all come from the same source. Because tagged data cannot be sent anywhere but its source, and the source of new data encompasses multiple sources, there is no place within the rules for permissive transfers to which it can be sent. Therefore, the special tag indicates "nowhere" and data tagged in this way cannot leave the scripting environment. the

In this particular embodiment, the propagation described above utilizes four increasingly restrictive source tag types:

None: The item has no source tag because the HTTP session or other means obtained through it is not designated as secure. the

Local: The item is entered by the user or loaded from a local file. the

Source: A standard source tag indicating where the data was obtained from. There may be many different sources used simultaneously in a scripting environment. the

Nowhere: The path through which the data item was obtained involves marking data that has more than one origin. the

These categories of tags that interact in the case of two-input script editing operations are shown in Table 1:

For a label type that enters a

Table 1

Just as for an operation with two inputs, a scripted edit operation with three or more input elements will assign its (each) output the most restrictive label type found in the input, except if the most restrictive type is " source" and there is more than one source location, "nowhere" will be used for the output as above. In the case of a single input operation, all outputs simply inherit the label of the input item. the

A series of steps for the determination of tags associated with the output of a script editing operation is represented in FIG. 5, although the specific sequence of operations shown in FIG. 5 relates to only one illustrative embodiment of the present invention. According to this embodiment, when an HTTP client retrieves 400 input data (such as a retrieved web page) from its local storage to begin processing, the HTTP client processes the input data in a conventional manner until a script is identified. The HTTP client then invokes its script interpreter 250 . Before executing each script instruction, the script interpreter extracts 410 the tag set associated with the input data element and passes it to the tag propagator 270 . The label propagator then applies a set of rules to determine the appropriate label for the output of the script editing operation. A shortcut to this process is possible if the check 420 for the presence of any source tags on the input data determines that there are no tags associated with the input data element. This "shortcut" is shown in the arrow between steps 420 and 500 of FIG. 5 . the

If the input does not have a label, then as determined in step 420, the output will not have an associated label either. However, if new data elements are loaded via user input or from a local file, these inputs will be processed as having a tag type of "local", in which case the output of the scripting engine's processing will also have an associated tag type of "local" (or, if combined with other labeled inputs, a more restrictive label type). This will be described in more detail below. the

If the determination at step 420 is positive, then the label propagation process according to the present embodiment is implemented in a sequence beginning with the most restrictive label type because there are relevant input labels. That is, the first step performed by the label propagator 270 includes determining 430 whether any input has the label type "Nowhere". If so, the tag type "Nowhere" is associated 440 with the scripting engine's output data element or elements. the

How tags are used to control data transmissions is described in more detail below under the section entitled "Use of Indication of Origin of Controlling Data Transmissions" following the description of an exemplary propagation sequence. However, an example of this control is provided here by way of illustration. When a data element has an associated tag type "nowhere", the script interpreter will be able to execute 500 script instructions, except that operations of the HTTP client in response to these script instructions will be subject to the restrictions imposed by the associated tag "nowhere" . Specifically, data elements with the "nowhere" tag will be prevented from being transferred outside the scripting environment. the

Returning to the propagation sequence of FIG. 5, if no input element has a tag type of "nowhere," the propagator determines 450 whether there are multiple inputs for a particular script instruction with multiple different "source" tags. If so, the tag type "Nowhere" is associated 440 with the output data element or elements. the

If the determination of step 450 is negative, the propagator determines 460 whether the input data element for the current script operation has a single "origin" type tag (ie, there is only one sensitive data element, or all sensitive data elements have the same origin). If so, an associated "source" type tag is associated 470 with the script instruction's output data element. the

If the determination at step 460 is negative, the propagator determines 480 whether any input to the current script instruction has an associated "local" tag type (including data elements entered by the user or loaded from a local file, which are considered to have "Local" tab - see above). If so, a "local" tag is associated 490 with the scripted operation's output data element. the

Having determined the tags to be associated with the output of the scripting operation, the scripting engine within the HTTP client then performs its process 500, subject to the restrictions on data transmission imposed by the tags as described below. Steps 410 to 500 are repeated for each script instruction within the script, and the scripting engine propagates tags as it executes. the

In addition to script editing actions, there can be other actions that act on the script field, but are not the actual script action itself. For example, the user typing in the text box is creating "local" data, but the user can combine this "local" data with the "source" data. In this case, the tag propagator component (or an equivalent component running elsewhere in the HTTP client) is expected to apply rules to determine the appropriate tags for the resulting data. In this embodiment, the HTTP client invokes the tag propagator to determine the appropriate tag for any such combination of tagged data. In other embodiments, the tag propagator may be implemented as a separate component from the scripting engine. In the example where the user types into a textbox, the scripting engine is typically called for each keypress, so that it can activate any part of the script that is registered to be notified of changes, so the tag propagator component of the scripting engine is easily called to Determine appropriate labels for new data. the

4. Indication of use of origin to control data transfers

Certain scripting operations involve the transmission of data from a web browser to a server anywhere on the network. For example, an HTML form (as defined in RFC1866) may be submitted under script control, XMLHttpRequest may be used (as described above), or the browser may be instructed to access its "path", "query", or "fragment" sections having been specially constructed as The URL of the means to carry the data. The present invention defines additional processing that must be performed before any data is allowed to leave the browser. The behavior is implemented in the browser's structured language program code without requiring any changes to the scripts running within it. the

Makes any script editing operation marked as able to transfer data dependent on the label of its input data. The input data of a script command may be the output of a previous script command, in which case the propagation of the above tags will have identified the associated tags for the control data transfer. Transport control may be implemented as a component of scripting engine 240, or may be implemented separately within the browser. The transfer operation must not complete if the data cannot be transferred according to the rules defined below. The operation preferably also reports errors (not necessarily pointed out to the user). the

Some transfer operations may take multiple inputs, which may potentially have different labels. In this case, the tags should be combined as described above with reference to the tag propagator 270 before the rules are allowed to be transmitted. the

If the transmitted data does not have any type of origin tag, it can be sent freely. This is the case for browsers that do not implement the invention (unless alternative data protection mechanisms are provided), as well as browsers that handle data that is not sensitive. the

If the data carries the special "nowhere" tag, it cannot be transferred outside the local scripting environment. the

If the data carries a source tag of type "source", the data may be transferred, but only to locations compatible with its tag. A compatible location is one of the following:

● have the same DNS domain or a subdomain thereof (for example, data whose source is "dev.company.com" can be sent to "docstore.dev.company.com"); and

Residing on the Internet Protocol port corresponding to the port number specified in the label (if the label specifies the port number); and

• If the tag specifies a path, also exist on that path or its descendants (eg, data whose source includes the path "/apps/expensetool" may be sent to "/apps/expensetool/submitform"). the

If the data carries a special "local" tag, the following rules can be implemented through the browser:

1. If there is no data with "origin" or "nowhere" tags within the script editing engine, the browser can assume that no sensitive data is involved and allow "local" data to be sent anywhere. This has the advantage of not changing the behavior of existing web pages and applications, but may be preferable for data substitution with "local" tags to avoid potential security exposure when new data elements are first created. the

2. If some data in the engine is sensitive, the browser can be configured to block the transmission of "local" data, or to ask the user before transmitting "local" information. However, if the decision is delegated to users, it must be recognized that users sometimes accept security exposures when they should not. In many cases, the data entered by the user will have been assembled by normal processing before sending the data with the origin tag, so the rules for the "source" tag, rather than the "local" tag, will follow. the

3. Many cases can be handled without resorting to user control by allowing "local" data to be transferred to that origin (while still questioning its distribution elsewhere) when all origin tags are the same in the browser. In common cases (such as secure document editing applications), the solution balances security and usability. the

The above set of rules strikes a balance between data security and disruption of the user experience, while recognizing that browsers may not have an explicit awareness of the sensitivity of such information. the

5. Extension of encrypted data

The above features provide a complete and advantageous system for controlling the transmission of sensitive information. However, these devices can be extended in a way that provides further usable capabilities by including the concept of encrypting data. Note that this is completely separate from any SSL encryption of the data stream in transit. the

The device requires specially written scripts to take advantage of it, unlike basic inventions that can be implemented with scripts and pages that don't change. To support this extension, new operations will be made available in the scripting engine that can convert data to and from encrypted form using properly disclosed ciphers. the

Add a fifth source tag: "encrypted". The rules for encrypted data are as follows:

Creation: The data may arrive encrypted, in which case this is indicated by an appropriate HTTP header in the transport carrying it. When a scripting engine's explicit encryption support is used to perform a scripting operation that encrypts existing data, the result is also tagged with the "encrypted" tag, regardless of any previous tags it may have carried. the

Dissemination: In general, combining encrypted data with other information is unlikely to be useful. It is however possible, in which case the output will take no encrypted input element's label (or the most restrictive such label if there is more than one), as for the normal propagation described above. the

Decryption: When decrypting encrypted data using a device with a scripting engine, the output gives a source tag of "nowhere" and cannot be transmitted. the

Transmission: Data marked "encrypted" can be transmitted anywhere since it is useless to any entity that does not hold the key. the

Thus, the present invention associates an indication of origin with sensitive data (whether tagging individual data elements or tagging web pages), files or databases containing sensitive data, and then controls the upward transmission of that data based on tags. Sensitive data may be entered by the user into the client data processing system, or the data may be maintained on a secure content server, such as within a stored web page, but the invention is applicable to any data deemed sensitive enough to arbitrarily control its upward transmission. In the above-described embodiments of the invention, large amounts of data would not have their upward transmission constrained in this manner, because the large amount of data available via the Internet is intended to be publicly available, and because the individual or organization that created or compiled a particular piece of information may have judged that it does not require Protect. However, there is also a large amount of private information accessible via data processing networks and potentially exposed through "untrusted" scripts, and if users are to safely and efficiently utilize available web services and scripts without exposing their information to others, then There is still a need to protect that information. the

Those skilled in the art will appreciate that the particular embodiments of the invention described above may be modified or extended in various ways within the scope of the invention and thus the above detailed description of the embodiments should be considered illustrative rather than limiting. the

For example, the new request headers described above represent only one possible implementation of the invention, and alternative embodiments of the invention do not require any new request headers. Instead, the security constraints on the use of requests of type XMLHttpRequest are released and replaced by modifying the scripting engine according to an embodiment of the present invention and marking this data as sensitive whenever it is obtained from a third-party website. Requests of type XMLHttpRequest cannot currently be used by scripts (at least not directly) to obtain data from a server other than the server from which the script was downloaded. This prevents attacks in which malicious JavaScript exploits the user's trust or the location of the user's data processing system behind a firewall to read data from a third-party site into the web browser and then transmit that data back to the script from which The site of origin. This is known as a "cross-site scripting vulnerability". Using source tags within the scripting engine according to embodiments of the present invention, and identifying the downloaded data as sensitive, prevents such attacks without relying on known limitations on XMLHttpRequest. Accordingly, downloading of data from third-party sites may be permitted for useful processing, while such data is marked as sensitive to maintain security. the

Second, different browsers may implement different mechanisms for inserting source tags in response to receiving data that includes a "sensitive data" flag; can also vary. Once those skilled in the art have read the above description of desired behavior, they will recognize various implementation options within the scope of the invention as defined in the present specification. the

Claims (13)

1. in script editing environment, carry out, for controlling a method for the transmission of sensitive data, comprise the following steps:

The indication in source is associated with the first data element;

The indication in source is propagated into the data element generating from the first data element, the data element of wherein said generation generates from described the first data element, and the step of wherein propagating the indication in source comprises:

Sign is for one or more input groups of script editing operation, and this script editing operation generates one or more output;

The indication in any source that sign is associated with one or more inputs;

From the indication in source of input, obtain the secondary indication in source; And

The secondary indication in the preservation source being associated with the output of one or more generations; And

The data element that limits the first data element and described generation is only transferred to the destination of license, wherein with reference to the destination of permitting described in the sign in source;

The step that the data element of the step wherein indication in source being associated with the first data element and restriction the first data element and described generation is only transferred to the destination of license is all in response to determines that the first data element comprises that sensitive data carries out.

2. the method for claim 1, wherein obtains the first data element from the source data disposal system away from script editing environment, and the step of wherein restriction transmission comprises that prevention the first data element is transferred to source data disposal system any destination in addition.

3. the method for claim 1, the step wherein indication in source being associated with the first data element is in response to determining that process the first data element by script editing operation carries out.

4. the method for claim 1, wherein associated, propagate and the step of restriction is carried out on client data treating apparatus, this client data treating apparatus comprises the network connection interface for communicating by letter with remote server data treating apparatus,

Wherein said method also comprises:

Via network connection interface, request is sent to remote server data treating apparatus, to retrieve the first data element from remote server data treating apparatus; And

From remote server data treating apparatus, receive data.

5. method as claimed in claim 4, the step wherein sending request is included in given client end data treating apparatus in this request and comprises for carrying out the parts of the step of restriction transmission.

6. method as claimed in claim 4, the step wherein indication in source being associated with the first data element is in response to receiving data and carry out from remote server data treating apparatus, and these data comprise the indication that comprises sensitive data about data.

7. method as claimed in claim 4; wherein the step of sending and receiving is carried out by HTTP client-side program; and wherein by HTTP client-side program, in response to HTTP request, obtain the first data element, this HTTP request comprises that HTTP client-side program can provide the indication to the protection of sensitive data.

8. the method as described in one of claim 4 to 7, wherein step associated and that propagate realizes by the script editing engine of moving in client data treating apparatus.

9. the method for claim 1, wherein retrieves the first data element from the data handling system away from script editing environment by script editing operation.

10. in script editing environment, carry out, for controlling a data handling system for the transmission of sensitive data, comprising:

For the parts that the indication in source is associated with the first data element;

For the indication in source being propagated into the parts of the data element generating from the first data element, wherein saidly for the indication in source being propagated into the data element that the parts of the data element generating from the first data element generate, from described the first data element, generate, wherein these parts comprise:

For identifying the one or more input groups for script editing operation, this script editing operation generates the device of one or more outputs;

For identifying the device of the indication in any source being associated with one or more inputs;

For the indication in the source from input, obtain the device of the secondary indication in source; And

The device of the secondary indication of originating for the preservation being associated with the output of one or more generations; And

For limiting, the data element of the first data element and described generation is only transferred to the parts of the destination of license, the destination of wherein permitting described in the sign of reference source from data handling system;

Wherein for parts that the indication in source is associated with the first data element and the parts that for limiting, the data element of the first data element and described generation are only transferred to the destination of license from data handling system, be all in response to and determine that the first data element comprises that sensitive data carries out.

11. data handling systems as claimed in claim 10, wherein from the source data disposal system away from script editing environment, obtain the first data element, and wherein for limiting the parts that the data element of the first data element and described generation is only transferred to the destination of license from data handling system, comprise for stoping the first data element to be transferred to the parts of source data disposal system any destination in addition.

12. data handling systems as claimed in claim 10, wherein for unit response that the indication in source is associated with the first data element in determining that process the first data element by script editing operation carries out.

13. data handling systems as claimed in claim 10, wherein retrieve the first data element from the data handling system away from script editing environment by script editing operation.

Images